Slashdot Mirror


Report Says China Will Demand Source Code

An anonymous reader alerts us to a two-week-old story that hasn't gotten much traction in the press to date. A Japanese newspaper and the AP report that China plans to demand source code from hardware manufacturers, and ban the sale of products from companies that don't comply. China is calling this an "obligatory accreditation system for IT security products." The plan is to go into effect next May, according to sources. "Products expected to be subject to the system are those equipped with secret coding, such as [a] contactless smart card system developed by Sony Corp., digital copiers, and computer servers. The Chinese government said it needs the source code to prevent computer viruses taking advantage of software vulnerabilities and to shut out hackers. However, this explanation is unlikely to satisfy concerns that disclosed information might be handed from the Chinese government to Chinese companies. There also are fears that Chinese intelligence services could exploit such confidential information by making it easier to break codes used in... digital devices."

11 of 305 comments (clear)

  1. Simple solution by DeltaQH · · Score: 5, Insightful

    Just use open source. ;-)

    1. Re:Simple solution by EdIII · · Score: 5, Insightful

      I'm thinking along the same lines in a security context. I have never supported Security Through Obscurity.

      If your security depends on your code being hidden, then I don't find it as valuable as a method that is open to scrutiny. Open Source Vs. Closed Source is a heated debate as always, but Open Source has a serious advantage when it comes to security. Trust. If the public at large can scrutinize the code, it is harder to say that anything nefarious is going on. With Closed Source, you HAVE to trust the company.

      Sony?

      Be fucking serious. The people that brought you a widespread implementation of a root kit to further their own agenda? I am going to have a hard time trusting ANY of their security products.

      I don't know why China may want to do this, but there are good arguments to support their position.

  2. yeah, right by speedtux · · Score: 5, Insightful

    that disclosed information might be handed from the Chinese government to Chinese companies

    It might. And then they have a massive re-engineering problem on their hands. It would usually be easier for them to reimplement the functionality than try to start with undocumented, unsupported source code.

    Doing security audits on software is a legitimate request by a governmental agency. Of course, they should just request that vendors provide open source software.

  3. The big question. by upuv · · Score: 5, Insightful

    Do companies think that the market in China is big enough to justify giving them the source code?

    It doesn't really matter what foreign governments think of this. The can scream all they want. If a company thinks the Chinese market is big enough and they want a piece of it. Then they will cough up the code.

    Privacy, security and IP rites are second tier considerations when it comes to product sales.

    So again. Do companies think that the market in China is big enough to justify giving them the source code?

  4. Biased view of the world have we? by mrboyd · · Score: 5, Insightful
    • When RMS wants the printer driver source code it's freedom protection.
    • When the chinese government wants his printer driver source code their trying to embezzle the gentle and caring westerners...

    I thought source should be free?

    I know American are scared, losing world leader status, economy going down the drain, hockey mom for vp and everything but seriously it's a great move on the Chinese government that you should be applauding. You should be hoping it will be replicated by ALL other governments and that distributing the source becomes an habit for HW manufacturer.
    China has its issue (police state, freedom of the press...), but they seem sometime to have the balls to go where no other lobbyist sponsored government in the "free world" would go and when it's a good move at least have the intellectual honesty to recognize it.

  5. Don't like it? Don't do business in China... by Bert64 · · Score: 5, Interesting

    The Chinese government is well within it's rights to make decisions regarding what goes on within it's borders. Infact, the whole purpose of a government is to put the interest of it's own country first above the interest of any foreign power.

    In this case, seeing the source code of electronic devices being sold in China is very much in their interest, why should the chinese government trust foreign corporations to supply black box equipment when they have no idea how it works? There are many people who boycott products, at least in certain areas, where they don't have source code... I wouldn't run an internet facing server on anything for which i didn't have the source for many reasons.

    If you don't like it, noone is forcing you to sell or manufacture your products in china. If you don't like their rules, go somewhere else... If you want to take advantage of the large customer base in china, as well as the cheap labour costs then you have to play by chinese rules.

    Ofcourse, this policy is also beneficial for those companies who already release their source code, since they're already compliant.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  6. Re:So they can counterfeit by sakdoctor · · Score: 5, Interesting

    It just doesn't work like this because those "western devices" are probably already made in Asia.

    I was visiting a Chinese factory that made widgets, and member of staff showed me a widget branded by a "famous western company" to impress upon me that the widgets made in their factory were of a high standard. "Here's a sample to take home, but don't tell anyone *wink* *wink*".

    Their agreement may not exclude selling the widget in part, or in whole on the domestic market, so the brands are in fact a complete myth. Those fake Sony goods that have been re-badged as a Chinese brand could be close to functionally identical, albeit with a much lower price tag.

    Another experience I had, was with a certain widget that had interchangeable parts. The product as a whole would be sold on the domestic market with Chinese branded parts, or swapped out for a brand that would know for export.

    It's all bullshit but very interesting to observe, and as an audience you are really overestimating the Chinese government's intervention which is close to none. This is just companies chasing profits with as much regard for ethics as our own companies.

  7. The Chinese are VERY dishonest. by Anonymous Coward · · Score: 5, Informative

    "Expect to see more Sorny goods if this goes ahead!"

    Maybe not. Maybe: "Expect to see a lot of counterfeit products labeled Sony, in the same kind of packaging Sony uses."

    Ever since the days of the DOS operating system, when it was only the Taiwanese who supplied computer parts, the Chinese have been extremely dishonest. They would deliver computer parts until a distributor got established. They would get paid when a load was delivered to a ship in Taiwan. But, the would eventually deliver a huge load of junk, stuff that had failed testing but had been saved for that purpose. That would put the U.S. distributor out of business.

    At the same time, there would be a Chinese distributor in town that just began doing business, selling the same items.

    Now that everyone has paid to build factories and complicated procedures in China, they are very vulnerable to Chinese control.

    Here are a few stories, chosen from thousands. The Chinese governments, in Taiwan and mainland China, have always pretended to be interested in stopping counterfeiting:

    FBI and Chinese seize $500 million of counterfeit software.

    Dangerous Fakes: How counterfeit, defective computer components from China are getting into U.S. warplanes and ships.

    YouTube videos about Chinese counterfeiting

    The World's Greatest Fakes: Chinese Copies Are Making Their Way Back To U.S.

    Heparin Find May Point to Chinese Counterfeiting

    Chinese Product Counterfeiting Causes US Job Layoffs

  8. Re:So they can counterfeit by uberjack · · Score: 5, Funny

    Hey, a Sorny would complement my Panaphonics and Magnetbox quite nicely

  9. Re:So they can counterfeit by edittard · · Score: 5, Insightful

    if you ask me, it's about time profligate western nations got a taste of what it's like at the other end of the stick.

    Brought to you by the two-wrongs-make-a-right department.

    One other thing. Extort doesn't normally take a person or people as its direct object.

    --
    At the bottom of the /. main page it says 'Yesterday's News'. Well they got that right.
  10. Re:So they can counterfeit by Anonymous Coward · · Score: 5, Funny

    That being said, one CANNOT overlook WHO is asking for the closed source, and determining the REAL reason WHY they need it. Somehow the words "safety" and "trust" do NOT come to mind.

    Is William Shatner posting on Slashdot now?